Privacy Policy

We collect only what is necessary to provide the service.

• Account information: When you create an account, we collect your email address and a hashed version of your password. We never store your password in plain text.
• Case answers: The answers you provide when working through a case, including your legal situation, housing details, family circumstances, and similar responses. These are stored so you can save progress and return later.
• Court papers you upload: Papers you add to a case, such as a motion or an order you received, as PDF or photo files up to 20 MB each. ProSay stores them and does not read them: they are not scanned, not used to answer your questions, and not sent to any AI provider.
• Problem reports you send us: the message, the email you give us, the page you were on, and which of your cases it was about, if any.
• Usage information: Standard server logs including IP address, browser type, and pages visited. We use this only for diagnosing problems and measuring basic usage.
• Usage events: We record a small set of events in our own database: when a document is prepared or fails to prepare, when you view a preview or download a document, and each step of a purchase (seeing the payment options, choosing one, starting payment and completing it). Each event records the time, your account, the case and document it concerns, and short labels such as the option you chose or the price. It never includes your answers or the contents of your documents. If you answer the optional question on the payment screen, we also store the short answer you type.
• Payment information: Payments are processed by Stripe on its own payment page. Your card details go directly to Stripe and never reach ProSay. We receive a confirmation of the payment, the amount and any tax charged, and the email address you paid with.

We do not collect geolocation data or device identifiers. We do not use tracking pixels, analytics cookies, or third-party analytics scripts: the usage events above stay in our own database and are not shared with anyone.

We use the information we collect to:

• ·Provide and operate the ProSay service. Specifically, to generate documents from your answers.
• ·Authenticate your identity and maintain your session.
• ·Send transactional emails (confirmation links, document delivery). We do not send marketing emails without your explicit consent.
• ·Diagnose technical problems and improve the platform, including from the usage events described above.
• ·Process your payments and keep the records of them that tax and accounting rules require.
• ·Comply with our legal obligations, including responding to valid court orders or legal process.

We do not use your case answers to train machine learning models or for any purpose beyond providing you the service.

We do not sell your data. We share information only with the following service providers, each under a data processing agreement:

• Supabase: Our database and authentication provider. Supabase stores your account information and case data on infrastructure hosted in the United States.
• Anthropic: Our AI document provider. When ProSay generates a document, the answers needed for that document are sent to Anthropic’s API to assemble the draft, and the completed document is sent to Anthropic’s API to check it before delivery. Anthropic processes this data only to provide the service and does not use it to train its models.
• Vercel: Our hosting provider. Vercel processes web requests and serves the ProSay application. Vercel does not have access to your case content.
• Resend: Email delivery for transactional messages such as account confirmation.
• Stripe: Payment processing. We send Stripe your email address and what you are buying and its price. Stripe collects your card details directly on its own page, and we receive only a payment confirmation and billing summary.

We may disclose your information if required by law, for example in response to a subpoena or court order. We notify you before complying unless legally prohibited from doing so.

You have the following rights regarding your personal information:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update your account information at any time. Case answers can be edited within the application at any step.
• Deletion: Delete your account and all associated data at any time from your account page, except the payment records described in Section 5. Deletion takes effect right away.
• Export: Request an export of your case data in a machine-readable format.
• Restriction: Ask us to stop processing your data while you dispute its accuracy.

To exercise any of these rights, email us at privacy@prosay.io. You can also delete your account yourself at any time from your account page. Connecticut residents have additional rights under the Connecticut Data Privacy Act (CTDPA), including the right to opt out of the sale of personal data, which we do not engage in.

• Account data: Retained for as long as your account is active. When you delete your account, we delete your account data right away, except payment records. Copies in our encrypted backups are overwritten within 30 days.
• Case answers: Retained until you delete them or delete your account. We recommend downloading your documents and deleting case data after your legal matter is resolved.
• Server logs: Retained for 90 days for security and debugging purposes, then permanently deleted.
• Generated documents: Retained until you delete them or delete your account. Download and keep a copy of any document you intend to file.
• Uploaded court papers: Stored in a private storage area under your account and case, which only your signed-in account can view, download or delete through ProSay. ProSay staff do not open your uploaded files except at your request or when the law requires it. Kept until you delete the file, the case or your account; deleting any of them removes the file.
• Payment records: What you bought, what you paid, any tax charged, and any refund are kept for seven years after the purchase, as tax and accounting rules require, even if you delete your account. When you delete your account, these records are no longer linked to it.
• Usage events: When you delete your account, your usage events are no longer linked to it.

We implement the following protections:

• ·All data is encrypted in transit using TLS 1.2 or higher.
• ·Data at rest is encrypted using AES-256 via Supabase's storage layer.
• ·Passwords are hashed using bcrypt before storage. We never have access to your plaintext password.
• ·Database access is restricted using Supabase Row Level Security (RLS) policies: your case data is accessible only to your authenticated account, and the same applies to uploaded files.
• ·Authentication sessions use secure, HttpOnly cookies that cannot be read by JavaScript.

No system is perfectly secure. If you discover a security vulnerability, please report it to privacy@prosay.io and we respond promptly.

We use one cookie:

• Session cookie (Supabase auth): Keeps you signed in between visits. HttpOnly and Secure. Expires when your session ends or after your inactivity period.

We do not use analytics cookies, advertising cookies, or third-party tracking cookies. We do not use Google Analytics, Facebook Pixel, or similar tools.

ProSay is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from minors. If you believe we have inadvertently collected information from a minor, please contact us at privacy@prosay.io and we delete it promptly.

Connecticut residents have the following rights under the Connecticut Data Privacy Act (CTDPA), effective July 1, 2023:

• ·Right to know whether we process your personal data.
• ·Right to access a copy of your personal data.
• ·Right to correct inaccuracies.
• ·Right to delete personal data you have provided.
• ·Right to data portability: export your data in a portable format.
• ·Right to opt out of targeted advertising, sale of personal data, or profiling (none of which we engage in).

To exercise CTDPA rights, contact us at privacy@prosay.io. We respond within 45 days.

We may update this policy from time to time. When we make material changes, we:

• ·Update the "Last updated" date at the top of this page.
• ·Send an email notification to all registered users.
• ·Display a notice on the ProSay website for at least 30 days.

Continued use of ProSay after a policy change constitutes acceptance of the updated terms. If you disagree with a change, you may delete your account at any time.

Questions about this policy or your privacy rights:

ProSay Privacy
privacy@prosay.io